Privacy Policy

Last updated: 8 October 2026

1. Controller

The controller for the processing described in this policy is:

Spectroplast GmbH

Flößergasse 2

81369 München Germany

Email: info@spectroplast.com

Website: www.spectroplast.com

2. Scope of This Policy

This policy explains how Spectroplast GmbH handles personal data when you visit our website, use our online shop, upload files, request a quote, place an order or contact us. It applies to business customers and to private buyers.

It covers our website www.spectroplast.com, our new online shop (new.shop.spectroplast.com), and our previous online shop (shop.spectroplast.com), which is operated with 3YOURMIND GmbH and which we keep until our links switch to the new shop.

3. Data We Collect and Why

3.1 Website Visit and Analytics

When you open www.spectroplast.com, our hosting provider Vercel receives technical data so that the page can be delivered: your IP address, the time, the page requested and information about your browser and device. We use these server logs to deliver the site, keep it stable and secure it. Logs are kept for one day (the log retention of our Vercel plan). Legal basis: Art. 6(1)(f) GDPR (our interest in a working and secure website). Vercel Inc. (USA) acts on our behalf.

Website images and files are delivered from the content network of our content system Sanity (Sanity Inc., USA). Sanity receives your IP address when it delivers them. Legal basis: Art. 6(1)(f) GDPR.

Analytics and marketing tools are activated only after your consent. Until you decide, no analytics or marketing tool is loaded and nothing is stored on your device for these purposes.

After you consent, the tools you allowed are loaded. We group them as follows.

Statistics. We use these tools to learn how the website is used and to improve it.

  • Google Analytics 4 (Google Ireland Limited, Ireland, and Google LLC, USA) records pages viewed, session length, device type and approximate location, linked to a pseudonymous identifier. This is pseudonymous data, not anonymous data. We use Google Consent Mode v2. We keep GA4 data for 14 months.
  • Vercel Analytics (Vercel Inc., USA) measures page views and performance.
  • Microsoft Clarity (Microsoft Corporation, USA) creates heatmaps and recordings of how visitors move through pages. Text you type is masked.

Marketing. We use these tools to measure the effect of our advertising and to link visits to your enquiry.

  • HubSpot tracking code (HubSpot Ireland Limited and HubSpot, Inc., USA) measures which pages you visit. If you allowed Marketing and then send one of our HubSpot forms (section 3.2) or sign in to our online shop, HubSpot links your earlier visits to your contact record. The online shop uses the same code (section 3.7 f).
  • LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company and LinkedIn Corporation, USA) measures conversions from LinkedIn advertising and builds audiences. For the collection and transmission of data to LinkedIn we and LinkedIn are jointly responsible under Art. 26 GDPR; LinkedIn is responsible for what it does with the data afterwards.
  • Microsoft Advertising UET tag (Microsoft Corporation, USA) measures conversions from Microsoft advertising and supports remarketing.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. The cookies and similar technologies these tools use are listed in section 4.

You choose in the cookie banner: Accept all, Decline, or Settings, where you can allow Statistics and Marketing separately. Session recordings are part of Statistics.

You can change your choice at any time with Cookie settings in the footer. If you withdraw your consent, the tools stop with the next page you open and we delete the cookies they set on spectroplast.com. Cookies that third parties store on their own domains we cannot delete; you can remove them in your browser. Data collected before your withdrawal remains lawful; ask us to erase it if you want it removed.

3.2 Contact Forms

When you submit a contact form on our website, we collect:

  • Name
  • Email address
  • Company name
  • Your message

The form is protected against automated misuse by Cloudflare Turnstile (Cloudflare, Inc., USA). When the form loads, Cloudflare receives your IP address and browser information to decide whether a person is using it. Legal basis: Art. 6(1)(f) GDPR (security of the form).

We forward your message by email through Resend (Resend Inc., USA) and store it in our CRM, Odoo (Odoo S.A., Belgium). Legal basis: Art. 6(1)(b) GDPR where your message concerns an offer or contract, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries).

Some pages of our website (campaign, event and resource pages) contain forms provided by HubSpot. If you have allowed Marketing, the form loads straight away. Otherwise it loads only when you click Show form; this connects your browser to HubSpot, which then receives your IP address, browser details, the address of the page and the page you came from, and sets Cloudflare's bot-protection cookie __cf_bm (30 minutes) on its own addresses. The form itself writes no cookie or other storage on spectroplast.com. If you allowed Marketing earlier, the form reads HubSpot's cookies and sends the visitor cookie hubspotutk with your submission, and HubSpot adds your earlier visits to your contact record; if you did not, there is no such cookie and nothing is linked. What you enter goes to HubSpot, our CRM, which acts on our behalf. Legal bases: Art. 6(1)(b) GDPR for quote, sample and demo requests, event registrations and downloads you ask for (marketing emails only with your separate consent); Art. 6(1)(f) GDPR for protecting the form against spam (§ 25(2) no. 2 TDDDG for the bot-protection cookie); Art. 6(1)(a) GDPR for linking your earlier visits.

Google reCAPTCHA. The HubSpot forms on our website (such as the downloads and the campaign forms) are protected against spam and abuse by Google reCAPTCHA, which tells people from bots. It is loaded with the form: after you click Show form or, if you allowed Marketing, when the page opens. reCAPTCHA receives your IP address, browser and device data, the address of the page and signals about how you interact with the form, and it stores a cookie (_GRECAPTCHA, 180 days) and entries in local and session storage on google.com, which we cannot delete. Google LLC (USA) provides reCAPTCHA to HubSpot as HubSpot's sub-processor and, according to Google, processes the data only for security, fraud and abuse prevention. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG, which you give by allowing Marketing in the cookie banner, which names Google reCAPTCHA, or by clicking Show form after a notice that names HubSpot and Google. If you do not want this, do not show the form: you can write to us instead (info@spectroplast.com), and you can remove the cookie in your browser. What you enter in the form has the legal bases given above.

3.3 File Upload and Online Shop (3YourMind)

Our 3D file upload platform and on-demand manufacturing store is powered by 3YourMind. When you upload a file and create an account, we collect:

  • Name and surname
  • Email address
  • Company name and address
  • Billing and shipping address
  • Uploaded 3D files and associated specifications
  • Order history and transaction data

This data is necessary to process your order, manufacture your parts, and fulfill our contractual obligations. Data is processed by 3YourMind GmbH (Germany) under a Data Processing Agreement.

3YourMind Privacy Policy: https://www.3yourmind.com/privacy-policy

Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

3.4 CRM and Order Management (HubSpot; Odoo)

When you ask about a product or place an order, we store your master data (name, address, account) and the correspondence and documents of our business relationship in our CRM. HubSpot is our CRM for the new shop (see 3.7 f). Odoo (Odoo S.A., Belgium) was our CRM before; it still receives the enquiries from the contact forms on our website and holds older records until further notice.

Legal bases: Art. 6(1)(b) GDPR to perform the contract and handle your enquiry; Art. 6(1)(c) GDPR for statutory documentation and retention duties; Art. 6(1)(f) GDPR for our interest in managing our customer relationships, documenting agreements so that we can assert or defend legal claims, and keeping in touch with business customers. We send email advertising only with your consent (§ 7 UWG). Retention: section 6.

3.5 Email Communication (Resend / Odoo)

We send transactional emails (sign-in codes, quotes, order and shipping updates, invoices, payment reminders, answers to your enquiries) through Resend (Resend Inc., USA), which acts on our behalf. We store delivery events such as a bounce or complaint with the order number and the type of event, without your email address. Legal basis: Art. 6(1)(b) GDPR.

Marketing emails, where applicable, are managed via Odoo. You can unsubscribe at any time via the link included in every marketing email or by contacting info@spectroplast.com.

Legal basis:

  • Transactional emails: Art. 6(1)(b) GDPR — contract performance.
  • Marketing emails: Art. 6(1)(a) GDPR — consent.

3.6 Internal Tools

Our staff use these tools, which can contain personal data such as names, email addresses and project information: Microsoft 365 (email, documents, collaboration), Notion (documentation, project management), Langdock (AI-supported internal workflows).

Our team also uses AI assistants (Claude, from Anthropic) for software development and operations, under a Claude Team plan. Through connectors they can reach our business systems (database, CRM, planning tool), which can contain personal data. Our internal rule is that customer data and files do not go into chats, tickets or documents. Anthropic Ireland, Limited processes the data on our behalf under the Anthropic Data Processing Addendum, which is part of Anthropic's Commercial Terms; for transfers to the USA it relies on the EU Standard Contractual Clauses included in that addendum.

Legal basis: Art. 6(1)(f) GDPR (efficient and secure business operations).

3.7 New Spectroplast Online Shop

Our new online shop is software operated by Spectroplast GmbH itself. It lets you upload 3D files, receive an instant quote, create an account, place orders, pay, and follow your project. The sections below apply to this shop, in addition to sections 3.1–3.6 for the rest of our website and for the previous shop.

a) Hosting and storage. The shop runs on Vercel (Vercel Inc., USA); its server functions run in Dublin, Ireland. Your data and files are stored with Supabase (Supabase Inc., USA) in a database and storage project in Ireland. Storage is private; files are reached only through short-lived signed links. Both providers act on our behalf under data processing agreements.

b) Data we collect.

  • First and last name, email address, company, phone number
  • Billing and shipping addresses
  • VAT ID and the result of its check against the EU VIES service
  • Uploaded 3D files and the measurements derived from them (dimensions, volume, printability check)
  • Quantities, materials, options, prices, quotes, orders, invoices and payment status
  • Messages exchanged with us on a project (in the shop, or from our CRM inbox)
  • Supporting documents you add (such as drawings and specifications)
  • A record of the version of this policy and of our terms you accepted

Purpose: to prepare quotes, manufacture and deliver your parts, invoice you and communicate with you. Legal basis: Art. 6(1)(b) GDPR — performance of a contract or pre-contractual steps; for the invoice data also Art. 6(1)(c) GDPR.

c) Your email address before the first price. Before we show the first price we ask for your email address and, if you like, your industry. We store this as an enquiry together with the files and settings you entered, so that we can reply and follow up on your request, even if you do not order. We create a contact in our CRM (HubSpot) within a few minutes. A cookie (sp_lead, 30 days) remembers that you passed this step. You confirm at this step, with a tick box, that you accept this policy; we record the version of the policy, the date and the time. Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR (our interest in answering enquiries).

If you allowed Marketing in the cookie banner and HubSpot has already set its cookie in your browser, we also pass your email address and HubSpot's cookie value to HubSpot at this step, as a form submission. HubSpot then creates your contact itself and adds the page views it recorded earlier, including visits to our website, so that we can see where you came from. We ask for nothing more at this step: your consent is the one you gave in the cookie banner, and you can withdraw it at any time under Cookie settings. If you did not allow Marketing, we send neither. Legal basis: Art. 6(1)(a) GDPR.

d) Account and sign-in. You sign in with a one-time code sent to your email address or with a password if you set one. Supabase Auth creates the codes and Resend delivers them. Your sign-in session uses cookies (section 4). Legal basis: Art. 6(1)(b) GDPR.

e) Payments. Card payments are handled by Stripe Payments Europe, Limited (Ireland) with Stripe, LLC (USA). You enter card details at Stripe; they never reach our systems, and we store only the payment status. Stripe receives your name, address, VAT ID and the amount. Stripe acts partly on our behalf and partly under its own responsibility, for example for fraud prevention and legal duties; see Stripe's privacy policy. You can also pay by invoice and bank transfer. Legal basis: Art. 6(1)(b) GDPR.

f) Customer relationship management (HubSpot). Contacts, quotes, orders, notes and your conversation with us are stored in HubSpot (HubSpot Ireland Limited and HubSpot, Inc., USA; hosting in the EU). HubSpot acts on our behalf. Purposes and legal bases are those in b) and c). Retention: section 6.

If you allowed Marketing, the shop also loads HubSpot's tracking code (HubSpot Ireland Limited and HubSpot, Inc., USA; EU data hosting), the same code as on our website. It sets four HubSpot cookies in your browser, shared with the website (section 4), and records which pages of the shop you open. A page is recorded only if its address contains no order or part number and nothing but campaign tags and, if you arrive from an advertisement, the click ID that the advertisement adds to its link (gclid for Google Ads, msclkid for Microsoft Advertising, li_fat_id for LinkedIn); any other page is not recorded at all. We do not store those click IDs ourselves. HubSpot's code also works out a hash from technical characteristics of your browser (such as screen, language and graphics) and adds it to the page views, to recognise one browser across our sites. We do not track staff or the back office, and the code does not collect what you type into forms or the text of what you click. When you are signed in, HubSpot receives your email address with your page views so that it can attach your visits to your contact record, including the visits you made before you signed in, on the shop and on our website (HubSpot recognises your browser by its cookie). If you withdraw your consent, tracking stops and we delete the four cookies; cookies that HubSpot's servers set on their own addresses we cannot delete. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.

g) Production planning (Notion). To manufacture your order we keep print-job records in Notion (Notion Labs Inc., USA): order number, part names, links to the files you uploaded, your company name and messages relating to the order. Legal basis: Art. 6(1)(b) GDPR.

h) Error monitoring (Sentry). To find and fix faults we use Sentry (Functional Software, Inc., USA; EU data region). Sentry receives technical error information. It is configured not to store IP addresses and not to receive the content of requests. When a page breaks, a recording of the interaction shortly before the error may be sent; all text in that recording is masked. Recordings are not made otherwise. Legal basis: Art. 6(1)(f) GDPR — our interest in a stable, secure service.

i) Material datasheets (Sanity). When you open a material datasheet (PDF) in the shop, it is delivered by Sanity (Sanity Inc., USA); your IP address is therefore transmitted to Sanity. Legal basis: Art. 6(1)(f) GDPR.

j) Automated pricing. Prices and the printability verdict are calculated automatically from your file and settings. This has no legal effect on you and does not significantly affect you in a comparable way; Art. 22 GDPR does not apply. Orders are reviewed and accepted by our team.

k) How you found the shop. When you open the shop, we read from your own request the campaign tags of the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the website you came from (its domain only), the kind of page you opened first in the shop and, for links from spectroplast.com, a marker showing which page of our website sent you. While you use the shop, this stays in your browser's memory; no cookie or other storage on your device is used for it. If you give us your email address or create an order, we store it with your customer details and with that enquiry or order, and in our CRM (HubSpot), so that we can see which channels bring enquiries and orders. This happens whether or not you have accepted cookies. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in knowing which of our channels lead to customers. You can object at any time (section 7). We keep this information as long as the customer record or the order it belongs to (section 6).

l) Partner discounts. If your confirmed email address belongs to the domain of a business partner with an agreed discount, the shop applies the discount automatically. Legal basis: Art. 6(1)(b) GDPR.

m) File conversion and order history from the previous shop. Our shop converts STEP and other CAD files into meshes itself; since October 2026 no file is sent to 3YOURMIND GmbH (Germany) for this. Before that, files were sent to 3YOURMIND GmbH, which acted on our behalf. We copy the order history from the previous shop into the new shop, and you can claim it in the portal. Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR (our interest in a complete customer history and an uninterrupted service).

n) Usage analytics (PostHog). If you allowed Statistics, we measure how you use the shop with PostHog (PostHog Inc., USA; PostHog Cloud EU, Frankfurt). Traffic goes through our own shop domain. IP addresses are discarded; only the country derived from the address is kept. We record page views (without query strings, except campaign tags), clicks (never the text of an element) and steps of your order (upload, price shown, options changed, quote requested, checkout started, order placed, paid) with technical details such as file type, material, delivery country, currency and order value. After you give your email address or sign in, the data is linked to a random customer number, never to your name or email address, with a few attributes: business or private buyer, industry, the country of your account, whether you have ordered before and whether you are a customer of our previous shop. On the landing, part and configure pages we also record how you use the page (screen recording and click maps). All text on these pages is hidden except a few fixed labels such as headings and buttons; everything you type is hidden, and the 3D view and part pictures are never recorded. We do not track staff or the back office. Order and payment steps that happen on our server are sent only if you allowed Statistics. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with Cookie settings; the recording then stops and the identifier is deleted. Recordings are kept for one month, other data for one year. If you delete your account, we delete your PostHog data too.

o) Combined analysis (PostHog data warehouse). To understand how visitors become customers, and which channels and steps of the ordering process lead to orders, we copy order and enquiry data from the shop's database, together with the category of each contact's source from our CRM (HubSpot), into PostHog's data warehouse once a day (PostHog Inc., USA; hosted in the EU, Frankfurt; as our processor, see n)). This is done for all customers, whether or not they accepted cookies. The copy contains no names, email addresses, companies, addresses, phone numbers, VAT numbers or file names. From the shop it contains: a random customer number; whether you are a business or a private customer, your industry, your country, whether your company has a partner agreement with us, whether you ordered in our previous shop, and whether you agreed to marketing; for each order its number, its status and the dates of its steps, the amount before VAT and the currency, the delivery country, the payment method and status, and the number of parts; for each upload the file type, the unit, the printability result and a one-way code of the upload session (not the file, its name or the session itself); and how you found the shop (k): campaign source, medium and name, the referring website, the kind of page you landed on and the tag of the link from our website. From HubSpot it contains only the category of your contact's source (for example paid search or organic search); our shop reads it from HubSpot and adds it to its own copy, and PostHog itself is not connected to HubSpot. These data are pseudonymised, not anonymous: with the customer number we can identify you. Where you accepted Statistics, the customer number is also the label of your usage data in PostHog, so the two can be viewed together; where you declined, there is no usage data to join and none is created for this purpose. We do not use the copy to make decisions about individuals or to select people for outreach. Legal basis: Art. 6(1)(f) GDPR, our interest in understanding which channels and which steps of the ordering process lead to orders. You can object to this at any time on grounds relating to your particular situation (see section 7); we then remove your data from the copy at the next daily update. PostHog only reads this copy; it changes nothing in the shop or in HubSpot. When you delete your account, your data leaves the copy at the next daily update.

4. Cookies

4.1 What We Use

Under § 25 TDDDG we need your consent to store or read information on your device, except where it is strictly necessary for a service you asked for. We therefore split the list below by whether consent is needed.

No consent needed

  • sp_consent (website and shop, spectroplast.com; Spectroplast): stores your cookie choice, the banner version and the date. Lifetime: 1 year (Safari: 7 days for cookies set by a script).
  • sp_upload_session (shop; Spectroplast): keeps your anonymous uploads together. Lifetime: 30 days.
  • sp_lead (shop; Spectroplast): remembers that you entered your email address. Lifetime: 30 days.
  • Sign-in cookies, names starting with sb- (shop; Supabase): keep you signed in. Lifetime: up to 400 days, or until you sign out.
  • __cf_bm (on HubSpot's addresses, set when you show a HubSpot form on our website; HubSpot): bot protection. Lifetime: 30 minutes.

Your consent needed: Statistics

  • _ga and _ga_<container ID> (website; Google): Google Analytics 4 statistics. Lifetime: 2 years.
  • _clck and _clsk on spectroplast.com (website; Microsoft): Clarity statistics and recordings. Lifetime: 1 year and 1 day. Microsoft also sets CLID and MUID (1 year each) on its own addresses, which we cannot delete.
  • Vercel Analytics (website; Vercel): sets no cookie but reads information from your device, so it needs your consent.
  • PostHog (shop; PostHog): usage analytics and screen recordings. A cookie ph_<project token>_posthog (1 year, on the shop's own address only) and the same entry in local storage (until you clear it); for the current browser tab only, four entries in session storage (ph_<project token>_posthog, ph_<project token>_window_id, ph_<project token>_primary_window_exists and ph_<project token>_session_registered_properties). A visit ends after 30 minutes without activity. If you withdraw your choice, we remove all of them.

Your consent needed: Marketing

  • HubSpot (website and shop; HubSpot): hubspotutk (visitor ID, 180 days), __hstc (visitor and visit numbers, 180 days), __hssc (counts the pages of the current visit, 30 minutes) and __hssrc (marks a new browser session, until you close the browser). The four are shared between spectroplast.com and the shop. HubSpot's servers also set Cloudflare's __cf_bm (bot protection, 30 minutes) on their own addresses, not on spectroplast.com.
  • LinkedIn (website; LinkedIn): li_fat_id on spectroplast.com (30 days, only if you arrive from a LinkedIn advertisement); on LinkedIn's own addresses, which we cannot delete: bcookie (1 year), lidc (1 day), li_gc (180 days), UserMatchHistory (30 days) and AnalyticsSyncHistory (30 days): conversion measurement and audiences.
  • Microsoft Advertising (website; Microsoft): on spectroplast.com _uetsid (1 day), _uetvid (13 months) and, if you arrive from a Microsoft advertisement, _uetmsclkid (90 days), each as a cookie and in local storage; on Microsoft's own address MUID (13 months): conversion measurement and remarketing.
  • HubSpot forms on our website (Google reCAPTCHA; Google): on google.com, which we cannot delete, the cookie _GRECAPTCHA (180 days), in local storage rc::a and rc::f (until you clear it) and in session storage rc::b and rc::c (this tab only). They tell people from bots and are set when a HubSpot form loads, whether you allowed Marketing or clicked Show form.

4.2 Your Choice and How to Change It

The shop shows the same cookie banner as the website, with equal buttons Accept all and Decline and a Settings link where you can allow Statistics and Marketing separately. One answer covers both sites, because both save it in sp_consent. A Decline on one site stops the other site's tools from the next page you open. Cookie settings in the footer opens the banner again. If you withdraw in the shop, the page reloads.

If we add a tool you have not yet been asked about, we ask again.

After you allow Statistics, the shop loads PostHog (section 3.7 n); after you allow Marketing, HubSpot's tracking code (section 3.7 f). Neither runs in the back office, on payment links or sign-in pages, or for our own staff.

5. Data Transfers Outside the EU

Some of our providers are in the USA. Where a provider is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). In every case we also use the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in our agreements where the provider offers them. You can get a copy of the safeguards by writing to info@spectroplast.com.

Providers, what they are used for, and the basis of the transfer:

  • Vercel Inc. — hosting, analytics — USA (the functions of the shop and of the website run in Ireland) — SCCs
  • Supabase Inc. — database, files, sign-in — USA (data in Ireland) — SCCs
  • Stripe Payments Europe, Limited (Ireland) and Stripe, LLC — payments — Ireland and USA — DPF and SCCs
  • Resend Inc. — transactional email — USA (sending from Ireland) — DPF and SCCs
  • HubSpot, Inc. — CRM, tracking — USA (data in the EU) — DPF and SCCs
  • Notion Labs, Inc. — production planning, internal — USA — DPF and SCCs
  • Functional Software, Inc. (Sentry) — error monitoring — USA (data in the EU) — DPF and SCCs
  • Sanity Inc. — content, datasheets — USA (data hosted primarily in Belgium) — SCCs
  • Cloudflare, Inc. — form protection — USA — DPF and SCCs
  • Google LLC — analytics; reCAPTCHA in the HubSpot forms of the website — USA — DPF and SCCs
  • Microsoft Corporation — Clarity, UET, 365 — USA (Microsoft 365 data stored in Switzerland, which the European Commission recognises as adequate) — DPF and SCCs
  • LinkedIn Corporation — Insight Tag — USA — DPF and SCCs
  • PostHog Inc. — usage analytics and data warehouse — USA (data in Germany) — DPF and SCCs
  • Anthropic Ireland, Limited — AI assistants — Ireland, with transfers to the USA — SCCs
  • Odoo S.A.; 3YOURMIND GmbH — former CRM; previous shop — Belgium; Germany — GDPR applies directly

6. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected:

  • Uploaded 3D files, meshes, thumbnails, attachments and copies of old-shop files: while your account exists; deleted when you delete it.
  • Order, quote and invoice records of the new shop: for the statutory retention periods under § 147 AO and § 257 HGB (up to 10 years).
  • How you found the shop (new shop): as long as the customer record or the order it belongs to.
  • Error reports (Sentry): deleted automatically once the retention period of our Sentry plan expires, and in any case when they are no longer needed to fix the fault.
  • Server logs: one day (the log retention of our Vercel plan).
  • Analytics data: GA4 max. 14 months (configured). Vercel Analytics and Clarity data is retained per each provider's standard terms; no personal data is retained by Vercel Analytics.
  • HubSpot visit history (website and shop): kept with the contact record.
  • PostHog: recordings 1 month, other data 1 year.
  • Daily copy into PostHog's data warehouse (3.7 o)): kept for 24 months at most, counted from the order, the upload or the enquiry. The copy is replaced in full once a day, so a record that is older than 24 months, was deleted or anonymised, or whose customer objected, is no longer in it after the next update.
  • Newsletter and marketing: Until unsubscription or withdrawal of consent.
  • Cookie consent record: 1 year (stored as a cookie in your browser).

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR) — Request a copy of the data we hold about you.
  • Right to rectification (Art. 16 GDPR) — Request correction of inaccurate data.
  • Right to erasure (Art. 17 GDPR) — Request deletion, subject to legal retention obligations.
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR) — You can object at any time, on grounds relating to your situation, to processing based on our legitimate interests (for example section 3.7 k). We will then stop unless we show compelling grounds. You can object to direct marketing at any time, without giving reasons.
  • Right to withdraw consent (Art. 7(3) GDPR) — At any time, without affecting prior lawful processing.

In the shop you can download your data (a zip file with a summary, a data file and your documents) and delete your account in the customer portal (“Delete my account”). This deletes your uploaded files, your part images, supporting documents and any order history imported from our previous shop, and anonymises your personal details on the account. It also deletes your usage data in PostHog. Documents we issued to you (quotes, order confirmations, invoices) are kept for the statutory retention period (Art. 17(3)(b) GDPR, § 147 AO). Your contact record in HubSpot and our production planning in Notion are removed by our team after you delete your account. For the previous shop, we pass your request to 3YOURMIND.

To exercise any of these rights, please contact us at:

Spectroplast GmbH

Flößergasse 2,

81369 München, Germany

Email: info@spectroplast.com

You also have the right to lodge a complaint with the competent supervisory authority:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18, 91522 Ansbach, Germany Website: https://www.lda.bayern.de

8. Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or disclosure, including:

  • HTTPS encryption for all website traffic.
  • Access controls on a need-to-know basis.
  • Data Processing Agreements with all third-party processors.
  • Private file storage with short-lived signed links.
  • Settings that keep IP addresses and request content out of error monitoring.
  • A database that refuses to delete an issued invoice.

9. Changes to This Policy

We update this policy when our services or the law change. You always find the current version at https://www.spectroplast.com/en/legal/privacy-policy. We tell you about material changes where the law requires it. If a change adds a tool that needs your consent, we ask you again.

10. Contact

For any questions about this policy or your personal data:

Spectroplast GmbH

Flößergasse 2

81369 München Germany

Email: info@spectroplast.com